amyanger 7436ac8e20 fix(javascript): drop built-in effects for visibly replaced globals (#4565) ...

The semantic collectors admitted Node timers, fetch, WebSocket, JSON.parse
and global coercions from the identifier spelling alone, so a source that
replaced those globals (`setTimeout = () => null`) still produced resolved
built-in effects. Require the existing isUnmodifiedGlobalReference guard,
which the static analyzer already uses for fetch and WebSocket, before
admitting these effects.

The guard treats any visible possible write as a replacement without
evaluating order or reachability, so computed global writes and guarded
polyfills also remove the resolved effect. The workflow docs now say so.

Fixes #3367

2026-10-23 02:28:53 +08:00

..

.vitepress

feat(python): inspect CPython pyc headers and marshal code objects (#4826)

2026-10-22 19:00:08 +08:00

assets

docs: keep license sections text-only

2026-10-10 00:09:46 +08:00

readme

feat(erlang): inspect BEAM IFF chunks and tables (#4833)

2026-10-22 17:46:15 +08:00

releases

chore(release/6.7.0): release rea-agents 6.7.0 (#4983)

2026-10-18 15:40:45 +08:00

specs

fix(environment): preserve UUID renewal ownership

2026-10-23 00:26:16 +08:00

verification

feat(apk): inspect signing declarations with retained fact queries

2026-10-22 11:48:09 +00:00

adb-device-analysis.md

fix(android): name the JADX deadline and recover apktool decode (#6024)

2026-10-22 00:31:43 +08:00

agent-environments.md

feat(environment): preserve view-specific written clock spellings

2026-10-23 00:12:26 +08:00

android-analysis.md

fix(android): name the JADX deadline and recover apktool decode (#6024)

2026-10-22 00:31:43 +08:00

apk-signature.md

feat(apk): inspect signing declarations with retained fact queries

2026-10-22 11:48:09 +00:00

apktool-resource-analysis.md

fix(android): name the JADX deadline and recover apktool decode (#6024)

2026-10-22 00:31:43 +08:00

apple-application-analysis.md

fix(apple): explain present rejected dylib candidates

2026-10-21 12:34:05 +08:00

architecture.mermaid

feat(apk): inspect signing declarations with retained fact queries

2026-10-22 11:48:09 +00:00

binary-diagnostics.md

feat(native): inspect PE and ELF export tables without an engine (#6278)

2026-10-22 01:30:05 -07:00

browser-observation.md

feat(javascript): retain queryable static route inventories (#6019)

2026-10-22 16:54:14 +08:00

browser-scenario-contract.md

fix(browser): ignore scenario storage enumeration order (#5035)

2026-10-23 02:26:41 +08:00

cli.md

feat(environment): compare an environment with probe captures of its application (#5699)

2026-10-22 21:52:01 +08:00

client-configuration.md

fix(setup): tell MSIX Claude Desktop's process view from any private roaming file (#4903)

2026-10-23 02:27:18 +08:00

client-verification.md

perf(mcp)!: default to compact input schema advertisements (#5975)

2026-10-22 00:17:11 +08:00

desktop-applications.md

fix(il2cpp): preserve recognized truncated metadata prefixes

2026-10-21 01:47:09 +08:00

electron-fuses.md

fix(electron): preserve selected fuse inspection paths (#3104)

2026-10-14 12:49:17 +08:00

electron-observation.md

feat(artifacts): make ASAR header admission configurable (#6209)

2026-10-21 21:18:22 -07:00

elf-notes.md

feat(elf): inspect PT_NOTE and SHT_NOTE tables (#4837)

2026-10-22 15:02:23 +08:00

erlang-beam.md

feat(erlang): inspect BEAM IFF chunks and tables (#4833)

2026-10-22 17:46:15 +08:00

error-contract.schema.json

fix(mcp): guide agents through tool error recovery (#5470)

2026-10-20 21:45:05 +08:00

evm-bytecode.md

fix(engines): keep format ceilings fixed and recover the EVMole deadline (#6088)

2026-10-22 03:06:59 +08:00

firmware-analysis.md

fix(firmware): keep a missing producer report distinct after exit 0 (#6008)

2026-10-21 07:52:40 -07:00

flutter-analysis.md

fix(flutter): select reported ABI labels through shared contracts

2026-10-19 18:38:57 +08:00

frida-instrumentation.md

fix(providers): name JEB, IDA, and one-shot command deadlines (#6014)

2026-10-22 04:01:02 +08:00

ghidra-dos.md

fix(ghidra): compare final DOS relocation windows

2026-10-17 19:30:11 +08:00

ghidra-mips.md

fix(ghidra): reconcile GNU MIPS ABI declarations

2026-10-14 14:47:26 +08:00

ghidra-nativeaot.md

fix(ghidra): use resolved type addresses for NativeAOT metadata

2026-10-15 21:05:33 +08:00

ghidra-ppc.md

feat(ghidra): admit 32-bit big-endian PowerPC ELF (#1747)

2026-10-14 06:35:55 +08:00

ghidra-provider.md

perf(ghidra): aggregate binary overview at the provider boundary (#4754)

2026-10-17 10:44:24 +00:00

ghidra-psp.md

feat(ghidra): admit bounded PSP ELF through installed Allegrex (#1599)

2026-10-11 19:47:33 +08:00

ghidra-riscv.md

feat(ghidra): support raw NMOS 6502 analysis (#2079)

2026-10-13 21:13:01 +08:00

go-binaries.md

feat(native): inspect a universal Mach-O slice in Go and Rust metadata readers (#6219)

2026-10-21 21:18:35 -07:00

godot-pck.md

feat(artifacts): inspect and extract Godot PCK with retained facts (#3634)

2026-10-20 09:53:53 +08:00

gpu-code-objects.md

feat(gpu): inspect static CUDA and HIP code objects (#5813)

2026-10-21 19:06:44 +08:00

harmony-analysis.md

fix(mobile): derive runtime hints from classified components

2026-10-17 20:02:26 +08:00

http3-capture-lab.md

test(http3): add real MITM capture verification lab (#1997)

2026-10-14 01:09:19 +08:00

ida-provider.md

fix(providers): name JEB, IDA, and one-shot command deadlines (#6014)

2026-10-22 04:01:02 +08:00

il2cpp-metadata.md

feat(il2cpp): link native methods and export Ghidra seeds

2026-10-20 21:56:54 +08:00

index.md

feat(apk): inspect signing declarations with retained fact queries

2026-10-22 11:48:09 +00:00

installation.md

fix(ghidra): treat format-specific disabled analyzers as not applicable (#5425)

2026-10-23 02:24:16 +08:00

javascript-application-graph.md

feat(managed): project call and field-access edges into the application graph (#6260)

2026-10-22 00:26:56 -07:00

javascript-application-workflows.md

fix(javascript): drop built-in effects for visibly replaced globals (#4565)

2026-10-23 02:28:53 +08:00

javascript-artifact-reconstruction.md

fix(electron): bind each contextBridge helper invocation to its own API (#6284)

2026-10-22 01:29:39 -07:00

javascript-recovery.md

fix(javascript): name heap and semantic ceilings (#6022)

2026-10-22 02:44:14 +08:00

javascript-route-inventory.md

feat(javascript): retain queryable static route inventories (#6019)

2026-10-22 16:54:14 +08:00

javascript-runtime-observation.md

fix(runtime): retain Inspector and Electron cleanup ownership

2026-10-19 14:03:28 +08:00

javascript-runtime-reconciliation.md

fix(javascript): keep encoded URL slashes inside one runtime path segment (#6259)

2026-10-22 00:26:12 -07:00

jeb-analysis.md

fix(providers): name JEB, IDA, and one-shot command deadlines (#6014)

2026-10-22 04:01:02 +08:00

kuna-provider.md

feat(process): make the regex worker heap request configurable (#6301)

2026-10-22 23:43:13 +08:00

managed-code-analysis.md

feat(managed): project call and field-access edges into the application graph (#6260)

2026-10-22 00:26:56 -07:00

mcp-contracts.md

fix(wasm): refuse unretained summary delivery before provider work (#5274)

2026-10-23 02:24:45 +08:00

mcp-prompts.md

fix(mcp): preserve procedure aliases and complete name ambiguity

2026-10-19 08:54:23 +08:00

migration-6.2.md

docs: correct MCP error and capture import guidance

2026-10-10 05:41:52 +08:00

model-artifacts.md

fix(model): keep host I/O failures distinct from unavailable model targets (#6175)

2026-10-23 02:21:50 +08:00

native-function-matching.md

feat(native): match retained function inventories across builds (#5390)

2026-10-20 09:48:52 +00:00

native-investigation.md

feat(process): make the regex worker heap request configurable (#6301)

2026-10-22 23:43:13 +08:00

packet-captures.md

test(perf): evaluate larger and non-HTTP packet workflows (#3232)

2026-10-14 16:18:22 +08:00

pcap-analysis.md

fix(pcap): preserve frames with empty protocol stacks (#5762)

2026-10-21 04:00:16 +00:00

pe-certificates.md

fix(pe): reject unsupported certificate name encodings

2026-10-22 17:25:24 +08:00

process-capture.md

fix(process): keep capture evidence when an admitted root's ancestor changes (#6264)

2026-10-22 00:28:26 -07:00

python-packaged-applications.md

feat(artifacts): inspect and extract PyInstaller archives

2026-10-21 12:48:29 +08:00

python-pyc.md

feat(python): inspect CPython pyc headers and marshal code objects (#4826)

2026-10-22 19:00:08 +08:00

raw-binary.md

feat(ghidra): support raw big-endian m68k analysis (#4018)

2026-10-16 23:57:34 +08:00

reconstruction-coverage.md

fix(reconstruction): require comparable cited Evidence for coverage

2026-10-15 18:39:57 +08:00

reconstruction-obligation-ledgers.md

fix(reconstruction)!: summarize obligation ledgers by cited Evidence authority (#5875)

2026-10-21 05:12:55 -07:00

reconstruction-readiness.md

docs(readiness): align required stage identifier and checks with evaluator (#2200)

2026-10-13 00:15:54 +08:00

recorded-crashes.md

fix(process): settle native exit and repair ownership verification (#5249)

2026-10-20 02:01:00 +08:00

releasing.md

fix(release): rehearse qualified packages before publication

2026-10-14 21:51:19 +08:00

reverse-engineering-tools.md

fix(hopper): bound bridge request frames like the Cutter bridge (#5262)

2026-10-23 02:25:24 +08:00

roadmap.md

docs: remove retired architecture and migration artifacts

2026-10-10 05:41:45 +08:00

rust-binaries.md

feat(native): inspect a universal Mach-O slice in Go and Rust metadata readers (#6219)

2026-10-21 21:18:35 -07:00

signal-recordings.md

fix(signals): report unknown decoder help IDs as invalid input (#5858)

2026-10-21 04:57:28 -07:00

sqlite-databases.md

fix(sqlite): attribute generated-column evaluation failures to the selection (#5879)

2026-10-21 04:08:49 -07:00

testing.md

fix(ghidra): treat format-specific disabled analyzers as not applicable (#5425)

2026-10-23 02:24:16 +08:00

tool-design.md

fix(process): retain diagnostics through bounded output finalization

2026-10-18 01:03:19 +08:00

user-visible-errors.csv

fix(mcp): escalate transient failures before asking for a restart (#6353)

2026-10-23 01:32:22 +08:00

wasm-artifacts.md

feat(wasm): make command deadlines adjustable with recovery guidance (#5798)

2026-10-21 15:00:05 +08:00

web-network-captures.md

feat(captures): make the HAR/SAZ/qlog decoder heap configurable (#6299)

2026-10-22 23:52:21 +08:00

web-runtime.md

fix(browser): name web-bundle budgets and recover web deadlines (#6036)

2026-10-22 05:47:38 +08:00

web-source-location.md

fix(browser): name web-bundle budgets and recover web deadlines (#6036)

2026-10-22 05:47:38 +08:00

website-module-trace.md

feat(browser): trace captured website module imports (#879)

2026-10-07 14:59:52 +08:00

website-script-export.md

fix(browser): preserve body API provenance through script export

2026-10-12 14:12:19 +08:00

windows-ghidra-p0.md

feat(ghidra): admit ARM PE targets on Windows (#3965)

2026-10-15 20:11:26 +08:00